Zero Radar
← feed
CriticalVulnerabilityCVE-2026-89035updated 25 Oct 2026, 16:35 UTC

MikroTik RouterOS WebFig can be logged into with stolen session tokens

Someone who copies a valid login token from your router's web admin page can reuse it to get admin access, and the access keeps working until the router's token list is manually cleared. This lets an attacker take over the router without kn

No fix yetOfficial, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Traffic interceptedAttacker captures a valid session token
  2. 2Token replayedToken reused in a new ECDH session
  3. 3Router login acceptedToken validated without channel check
  4. 4Persistent admin accessAccess lasts until token store is cleared
  5. ResultAttacker gains persistent router admin access

What happened

In MikroTik RouterOS through 7.24.5, the WebFig web interface generates session tokens in libucrypto.so's makeSessionKey function using fixed salts and no channel- or session-specific input, and the user service accepts those tokens without checking channel context, allowing replay of captured tokens across new ECDH sessions.

Why it is dangerous: A captured token grants persistent administrative control of the router, which can expose or redirect the traffic of everything behind it. Anyone who runs or manages MikroTik routers with WebFig exposed is at risk, especially where traffic can be intercepted.

Are you affected?

You are affected if you run MikroTik RouterOS through 7.24.5 with the WebFig web interface enabled.

MikroTik RouterOS through 7.24.5 (WebFig interface)

What to do

  1. Check your RouterOS version and treat any version through 7.24.5 as vulnerable
  2. Disable WebFig, or restrict it to a trusted management network only
  3. Clear the router's token store to invalidate any tokens already captured
  4. Watch for a vendor fix and update RouterOS as soon as one is released

Timeline

  1. 21 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 21 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-89035 · GHSA-j7mx-6943-qw55
CVSS
9.1 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 18:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

MikroTik RouterOS WebFig can be logged into with stolen session tokens · Zero Radar